What happens when a switch receives a frame with a destination MAC (Media Access Control) address that is NOT in its MAC address table?

The switch floods the frame out all ports except the ingress port — this is called unknown unicast flooding.

* Unknown-unicast flooding and learning. *

The full sequence when the destination is unknown:

1. Frame arrives on port X
2. Switch learns the source MAC → records it mapped to port X
3. Switch looks up the destination MAC → not found in the table
4. Switch floods the frame out all ports except port X
5. The destination device receives the frame and replies
6. When the reply arrives, the switch learns the destination's MAC address too
7. Future frames to that destination are forwarded to the specific port only (no more flooding)

This is exactly the same behavior as for broadcast frames, but for a different reason:

• Broadcast → flooding is intentional (all devices need to see it)
• Unknown unicast → flooding is a fallback because the switch doesn't know the destination yet

Why this matters for security: An attacker can exploit this with a MAC flooding attack (CAM (Content Addressable Memory) table overflow), forcing the switch into a hub-like state where all traffic is flooded to all ports. This is why port security is important (covered in later modules).

Go deeper:

• MAC flooding (Wikipedia) — how attackers weaponize unknown-unicast flooding by overflowing the CAM table.
• Forwarding information base (Wikipedia) — the MAC-to-port table whose miss triggers the flood.